Starbucks admits to storing user passwords in plain text, vows to update iPhone app with fix

In the wake of the 40 million customer payment cards that were compromised due to a Target security breach, greater attention is being paid to the efforts of major consumer chains to protect our data. This week’s events indicate that while Starbucks is generally considered one of the more tech-savvy brands, this savviness does not apply to information security.

Here’s the scenario. Back in November, security researcher Daniel Wood noted a flaw in Starbuck’s iOS app: user passwords were being stored in the app as plain text, and could be viewed by anyone able to connect the device to a computer and grab its crash logs. After months of trying and failing to inform Starbucks’ corporate security team, Wood published his findings on Monday. Starbucks then claimed yesterday that they had fixed the issue already, which didn’t make any sense, as such a fix would require an app update. Today, in a press statement, Starbucks has admitted to the vulnerability and announced it is working to quickly release an iOS update.

First, not hashing user data is, at a development level, just a bad move; for a large consumer brand like Starbucks it’s a violation of trust – consumers simply expect greater protection of their personal data. But while the vulnerability itself is troubling, Starbucks’ actions are more so, indicating either a limited understanding of mobile security, or an attempt to mislead the public.

Starbucks’ press statement (posted below) refers to the issue as a “theoretical vulnerability”, of which “there is no indication that any information has been compromised” – off-putting statements when theoretical in this case becomes practical with a Lightning cable and a limited familiarity with iPhone crash logs (something every iOS developer or QA tester has). Starbucks claims that its prior measures “sufficiently address the concerns raised in the research report” are confusing due to the nature of the vulnerability itself, and disingenuous in the face of a forthcoming app update, which the company claims is “out of an abundance of caution.”

Starbucks may simply be muddling the issue in an attempt to simplify it for consumers, but honestly, consumers know better. They read sites various tech-related sites, and they know how to use Google – ‘clear’ statements running counter to the rest of the Internet simply won’t fly. Starbucks first needs to fix its mobile security holes, but a second look at its messaging practices wouldn’t hurt, either.

January 16, 2013
Dear Customer,

Sincerely,
Curt Garner
Starbucks chief information officer